syzbot


KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets

Status: auto-closed as invalid on 2020/11/13 10:47
Subsystems: wireguard
[Documentation on labels]
First crash: 1294d, last: 1294d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (2) wireguard 1 1233d 1233d 0/26 auto-closed as invalid on 2021/01/13 19:06
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (7) wireguard 1 34d 34d 0/26 moderation: reported on 2024/03/22 19:02
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (4) wireguard 1 229d 229d 0/26 auto-obsoleted due to no activity on 2023/10/14 08:22
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (5) wireguard 1 186d 186d 0/26 auto-obsoleted due to no activity on 2023/11/26 10:20
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (3) wireguard 1 513d 504d 0/26 auto-obsoleted due to no activity on 2023/01/03 22:04
upstream KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets (6) wireguard 1 106d 104d 0/26 auto-obsoleted due to no activity on 2024/02/14 17:18

Sample crash report:
==================================================================
BUG: KCSAN: data-race in wg_packet_send_keepalive / wg_packet_send_staged_packets

write to 0xffff88809fb71a40 of 8 bytes by interrupt on cpu 0:
 __skb_queue_head_init include/linux/skbuff.h:1869 [inline]
 skb_queue_splice_init include/linux/skbuff.h:1955 [inline]
 wg_packet_send_staged_packets+0xf8/0x990 drivers/net/wireguard/send.c:359
 wg_xmit+0x56b/0x6a0 drivers/net/wireguard/device.c:197
 __netdev_start_xmit include/linux/netdevice.h:4681 [inline]
 netdev_start_xmit include/linux/netdevice.h:4695 [inline]
 xmit_one+0xc0/0x310 net/core/dev.c:3561
 dev_hard_start_xmit net/core/dev.c:3577 [inline]
 __dev_queue_xmit+0xf00/0x15a0 net/core/dev.c:4136
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4169
 neigh_connected_output+0x24f/0x280 net/core/neighbour.c:1518
 neigh_output include/net/neighbour.h:509 [inline]
 ip6_finish_output2+0x97f/0xb20 net/ipv6/ip6_output.c:117
 __ip6_finish_output+0x302/0x330 net/ipv6/ip6_output.c:143
 ip6_finish_output+0x39/0x160 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:443 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ndisc_send_skb+0x449/0x5f0 net/ipv6/ndisc.c:506
 ndisc_send_rs+0x3aa/0x3e0 net/ipv6/ndisc.c:700
 addrconf_rs_timer+0x35b/0x540 net/ipv6/addrconf.c:3873
 call_timer_fn+0x30/0x2a0 kernel/time/timer.c:1413
 expire_timers+0x116/0x290 kernel/time/timer.c:1458
 __run_timers+0x348/0x3e0 kernel/time/timer.c:1755
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1768
 __do_softirq+0x198/0x360 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x5b/0x70 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu+0x115/0x120 kernel/softirq.c:423
 sysvec_apic_timer_interrupt+0xba/0xd0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
 get_current arch/x86/include/asm/current.h:15 [inline]
 __sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:196
 tomoyo_check_acl+0x102/0x220 security/tomoyo/domain.c:175
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_path_perm+0x22f/0x330 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x18/0x20 security/tomoyo/tomoyo.c:123
 security_inode_getattr+0x7f/0xd0 security/security.c:1278
 vfs_getattr fs/stat.c:121 [inline]
 vfs_statx+0x118/0x2b0 fs/stat.c:206
 vfs_lstat include/linux/fs.h:3178 [inline]
 __do_sys_newlstat fs/stat.c:374 [inline]
 __se_sys_newlstat+0x46/0x250 fs/stat.c:368
 __x64_sys_newlstat+0x2d/0x40 fs/stat.c:368
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88809fb71a40 of 8 bytes by interrupt on cpu 1:
 skb_queue_empty include/linux/skbuff.h:1523 [inline]
 wg_packet_send_keepalive+0x21/0x120 drivers/net/wireguard/send.c:225
 wg_expired_send_keepalive+0x1c/0x110 drivers/net/wireguard/timers.c:83
 call_timer_fn+0x30/0x2a0 kernel/time/timer.c:1413
 expire_timers+0x116/0x290 kernel/time/timer.c:1458
 __run_timers+0x348/0x3e0 kernel/time/timer.c:1755
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1768
 __do_softirq+0x198/0x360 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x5b/0x70 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu+0x115/0x120 kernel/softirq.c:423
 sysvec_apic_timer_interrupt+0xba/0xd0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
 apparmor_socket_sendmsg+0x0/0x30 security/apparmor/lsm.c:928
 security_socket_sendmsg+0x45/0x90 security/security.c:2124
 sock_sendmsg net/socket.c:668 [inline]
 ____sys_sendmsg+0x316/0x4d0 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmmsg+0x322/0x4b0 net/socket.c:2497
 __do_sys_sendmmsg net/socket.c:2526 [inline]
 __se_sys_sendmmsg net/socket.c:2523 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2523
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 16467 Comm: syz-executor.4 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/09 10:46 upstream 583090b1b823 fa79ed2a .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.